Re: [Qemu-stable] [Qemu-devel] [PATCH v2 6/7] qdev: Protect device-list-properties against broken devices

[Markus Armbruster]

Eduardo Habkost <address@hidden> writes:

> On Wed, Sep 23, 2015 at 04:09:48PM +0200, Markus Armbruster wrote:
>> Several devices don't survive object_unref(object_new(T)): they crash
>> or hang during cleanup, or they leave dangling pointers behind.
>> 
>> This breaks at least device-list-properties, because
>> qmp_device_list_properties() needs to create a device to find its
>> properties.  Broken in commit f4eb32b "qmp: show QOM properties in
>> device-list-properties", v2.1.  Example reproducer:
>> 
>>     $ qemu-system-aarch64 -nodefaults -display none -machine none -S
>> -qmp stdio
>>     {"QMP": {"version": {"qemu": {"micro": 50, "minor": 4, "major":
>> 2}, "package": ""}, "capabilities": []}}
>>     { "execute": "qmp_capabilities" }
>>     {"return": {}}
>>     { "execute": "device-list-properties", "arguments": {
>> "typename": "pxa2xx-pcmcia" } }
>>     qemu-system-aarch64: /home/armbru/work/qemu/memory.c:1307:
>> memory_region_finalize: Assertion `((&mr->subregions)->tqh_first ==
>> ((void *)0))' failed.
>>     Aborted (core dumped)
>>     [Exit 134 (SIGABRT)]
>> 
>> Unfortunately, I can't fix the problems in these devices right now.
>> Instead, add DeviceClass member cannot_even_create_with_object_new_yet
>> to mark them:
>> 
> [...]
>> * Dangling pointers: most CPUs, plus "allwinner-a10", "digic",
>>   "fsl,imx25", "fsl,imx31", "xlnx,zynqmp", because they create such
>>   CPUs
>
> TYPE_TILEGX_CPU doesn't have cannot_even_create_with_object_new_yet set,
> but it calls cpu_exec_init() on instance_init too.

Rats, missed one!  Test survived the dangling pointer somehow.  Will fix
in v3.

> For the remaining changes:
>
> Reviewed-by: Eduardo Habkost <address@hidden>

Thanks!